{"action":"closed","issue":{"url":"https://api.github.com/repos/LibVNC/libvncserver/issues/190","repository_url":"https://api.github.com/repos/LibVNC/libvncserver","labels_url":"https://api.github.com/repos/LibVNC/libvncserver/issues/190/labels{/name}","comments_url":"https://api.github.com/repos/LibVNC/libvncserver/issues/190/comments","events_url":"https://api.github.com/repos/LibVNC/libvncserver/issues/190/events","html_url":"https://github.com/LibVNC/libvncserver/issues/190","id":239383651,"number":190,"title":"segfault / double-free in rfbClientCleanup method","user":{"login":"willbprog127","id":1296250,"avatar_url":"https://avatars3.githubusercontent.com/u/1296250?v=3","gravatar_id":"","url":"https://api.github.com/users/willbprog127","html_url":"https://github.com/willbprog127","followers_url":"https://api.github.com/users/willbprog127/followers","following_url":"https://api.github.com/users/willbprog127/following{/other_user}","gists_url":"https://api.github.com/users/willbprog127/gists{/gist_id}","starred_url":"https://api.github.com/users/willbprog127/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/willbprog127/subscriptions","organizations_url":"https://api.github.com/users/willbprog127/orgs","repos_url":"https://api.github.com/users/willbprog127/repos","events_url":"https://api.github.com/users/willbprog127/events{/privacy}","received_events_url":"https://api.github.com/users/willbprog127/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-06-29T07:01:08Z","updated_at":"2017-06-30T20:40:41Z","closed_at":"2017-06-30T20:40:41Z","body":"At line\r\nhttps://github.com/LibVNC/libvncserver/blob/master/libvncclient/vncviewer.c#L537\r\nyou have the code `free(client)`.  This `free` causes a segfault on FreeBSD and segfault + 'double-free' error message on Linux.\r\n\r\nI don't have the time to do a full code review of your project, but I do see that you're using `calloc` in rfbGetClient, so I'm not sure why the client seems to be freed twice.\r\n\r\n```\r\nProgram received signal SIGSEGV, Segmentation fault.\r\n[Switching to Thread 805216f00 (LWP 100511/spiritvnc-fltk)]\r\n0x0000000802f86338 in realloc () from /lib/libc.so.7\r\n(gdb) bt full\r\n#0  0x0000000802f86338 in realloc () from /lib/libc.so.7\r\nNo symbol table info available.\r\n#1  0x0000000802f8685e in free () from /lib/libc.so.7\r\nNo symbol table info available.\r\n#2  0x0000000000433896 in VncObject::endViewer (this=0x805340880) at src/vnc.cxx:274\r\n        nItem = 0\r\n```\r\n`src/vnc.cxx:274` is simply calling `rfbClientCleanup(vncClient)`.\r\n\r\nlldb shows about the same thing:\r\n\r\n```\r\n    frame #0: 0x0000000802f86338 libc.so.7`??? + 264\r\nlibc.so.7`???:\r\n->  0x802f86338 <+264>: movq   %r15, (%rax,%rbx)\r\n    0x802f8633c <+268>: movl   0x18(%rcx), %eax\r\n    0x802f8633f <+271>: testl  %eax, %eax\r\n    0x802f86341 <+273>: jle    0x802f86487               ; <+599>\r\n(lldb) bt\r\n* thread #3: tid = 100531, 0x0000000802f86338 libc.so.7`??? + 264, stop reason = signal SIGSEGV: invalid address (fault address: 0xfffffffffffffff8)\r\n  * frame #0: 0x0000000802f86338 libc.so.7`??? + 264\r\n    frame #1: 0x0000000802f8685e libc.so.7`free + 126\r\n    frame #2: 0x0000000000433896 spiritvnc-fltk`VncObject::endViewer(this=0x0000000805340880) + 3078 at vnc.cxx:274\r\n```\r\nBecause I don't have debugging symbols for libc or libvncserver, I completely implemented the rfbClientCleanup function in my project.  gdb pointed to the `free(client)` line as the problem.  Commenting out that line prevents the crash from happening."}}
{"actor":{"display_login":"willbprog127"}}